June 2008 - Freeradius-Users - lists.freeradius.org

(Fwd) Error on Accounting SQL
by Breuer Nicolas 05 Jun '08

05 Jun '08

Hello , Seems to have a bug on 2.0.4 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details The accounting is stored into the SQL. Paste the debug here : ++[files] returns noop +- entering group accounting expand: %{User-Name} -> BCXXX rlm_sql (sql): sql_set_user escaped user --> 'BCXXX' TRIED THE UPDATE RADACCT . expand: UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets- 64}', AcctOutputOctets = '%{Acct-Output-Octets-64}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' -> UPDATE radacct SET FramedIPAddress = '', AcctSessionTime = '', AcctInputOctets = '', AcctOutputOctets = '' WHERE AcctSessionId = '0D00003F280001EB-483E2C69' AND UserName = 'BCXXX' AND NASIPAddress= '217.112.179.x' rlm_sql (sql): Reserving sql socket id: 3 NOT POSSIBLE because the line doesn't exists so Alternate SQL query should be used. >>>>>> WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details >>>>> What's this error below ? ALTERNATE QUERY expand: INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic,ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId,CallingStationId, ServiceType, FramedProtocol, FramedIPAddress,AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session- Id}','%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}','%{NAS-Port- Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} +%{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}','', '%{Acct-Input-Octets-64}', '%{Acct- Output-Octets-64}', '%{Called-Station-Id}','%{Calling-Station-Id}', '%{Service- Type}','%{Framed-Protocol}-1','%{Framed-IP-Address}', '0') -> INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic,ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId,CallingStationId, ServiceType, FramedProtocol, FramedIPAddress,AcctStartDelay) values('0D00003F280001EB-483E2C69', '5c28bc24233262ac','BCXXX', '', '217.112.179.X', '3777167632','Virtual', DATE_SUB('2008- 06-04 17:36:58',INTERVAL (0 +0) SECOND), '', '','', '', '', '','', 'Framed-User','PPP-1','', '0') rlm_sql (sql): Released sql socket id: 3 OK ++[sql] returns ok ++? if (!ok) ? ------- End of forwarded message -------

2 1

FreeRADIUS and SQLite: any experiences?
by Jos Vos 05 Jun '08

05 Jun '08

Hi, Since 2.0.3 (according to the changelog) there is a SQLite driver added (rlm_sql_sqlite). It is said to be preliminary and untested. Is anybody actually using it and able to provide some feedback? Thanks, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

2 1

Maximum Vendor Specific AV Pairs
by Danny Paul 05 Jun '08

05 Jun '08

Greetings All, I'm running FreeRADIUS version 1.1.7. I notice that sometimes not all vendor specific AV pairs are included in access-accept packets. I suspect that this is because I am hitting the maximum packet size of 4096 bytes. However, some of the information I've read tells me that there is no limit on the VSAs that can be included in an access-accept packet. Which is it? I've run the server in full debugging mode and there is no output relating to dropping attributes from the access-accept packet. All the best!

2 1

Reconfiguration of "rlm_fastusers.c" to compare User-Name in a case-insensitive
by Khaiti, Issam (ext) 05 Jun '08

05 Jun '08

Hi,All! Is there anybody knows, how can I extend or reconfigure " rlm_fastusers.c " , so that this one do match User-Names in a case-insensitive. Thank you in advance.

2 1

different cost for different services
by sub 04 Jun '08

04 Jun '08

Hello everybody, I'm going to set-up different services that are going to use the same freeradius server and accounts. So actually I have user X that with the same username/password can use service A and service B connecting from different NAS; services have a different cost to the end user. Is it possibile to configure freeradius in such a way where, for me, cost means a different amount of seconds? Thanks, sub

2 1

Freeradius with SAMBA
by vijayakumar 04 Jun '08

04 Jun '08

Dear All, I want to use my /etc/smbpasswd file for authenticating MSCHAP V2 .Is it possible??????? .If so what configuration changes to be made in raius.conf,eap.conf etc.......... Thanks in advance.. Regards. VIJAY

2 1

FreeRadius + OpenLDAP + Router Cisco VPN
by youness hsina 04 Jun '08

04 Jun '08

Hi all, sorry for my english ! i want to thank every all the member of this list for help that was given to me already . i'm going o introduce my subject. i configured a Radius server with LDAP and a router CISCO VPN . every thing is works with no problem! i can authentificate from my router cisco to the radius server i can authentificate from radius server to ldap server Every thing is OK !! i can also make a connection with my vpn router using the softwar ( UGent Vpn ) on a client machine i have some user on the ldap data base and i want to make test on my client machine . Do you know the software that can make a connection to the ldap using vpn connection ? any ideas will be appreciated thank you very much -- uness

1 0

TLS/wired fail
by 娟严 03 Jun '08

03 Jun '08

Hi,All! I 'd like to add some infos about this issue. TLS/wired is failed,but MD5/wired is successful. It's Ok when I use AP instead of switch authenticating eap/tls and eap/ttls with the same freeradius. Is it the problem of switch or the problem of radius? I think it's the problem of radius server,because md5 can authenticate successful, that means 802.1X works properly on switch. So how to configure freeradius as wired authentication? I don't use sql, I just add some items at the end of the users file,just like this: switch_client Cleartext-Password :="whatever" #################################### Hi,All! My freeradius version is v2.0.2,and I use cisco 2950 switch as Authenticator; the packet sent by server miss the EAP-TLS Fragments(server sent a packet which miss the server hello and ciper suilt messages after received a client hello packet),I don't kown what the prolbem.Can anybody help me? Here are the packets,the ip of radius server is:192.168.0.197,the ip of switch is:192.168.0.123. No. Time Source Destination Protocol Info 63 89.556162 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=3, l=116) Frame 63 (158 bytes on wire, 158 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.456040000 [Time delta from previous captured frame: 1.228814000 seconds] [Time delta from previous displayed frame: 89.556162000 seconds] [Time since reference or first frame: 89.556162000 seconds] Frame Number: 63 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x38c9 [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 124 Checksum: 0x12c3 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x3 (3) Length: 116 Authenticator: FE6787CBF64C4301CBAD5355610B9634 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=20 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 18 Type: Identity [RFC3748] (1) Identity (13 bytes): switch_client AVP: l=18 t=Message-Authenticator(80): 1C066799CF105346E40019AA2E291D22 Message-Authenticator: 1C066799CF105346E40019AA2E291D22 No. Time Source Destination Protocol Info 66 89.572574 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=3, l=64) Frame 66 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.472452000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.016412000 seconds] [Time since reference or first frame: 89.572574000 seconds] Frame Number: 66 Frame Length: 106 bytes Capture Length: 106 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 92 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb800 [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 72 Checksum: 0x82ea [incorrect, should be 0xa1e2 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x3 (3) Length: 64 Authenticator: D2EF3D5B79C3B1A4742E4A8C5FB00BD0 Attribute Value Pairs AVP: l=8 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 6 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x20): Start AVP: l=18 t=Message-Authenticator(80): A58A6FE1C598F8E9A979BABECD78BF65 Message-Authenticator: A58A6FE1C598F8E9A979BABECD78BF65 AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE No. Time Source Destination Protocol Info 67 89.681078 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=4, l=224) Frame 67 (266 bytes on wire, 266 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.580956000 [Time delta from previous captured frame: 0.108504000 seconds] [Time delta from previous displayed frame: 0.108504000 seconds] [Time since reference or first frame: 89.681078000 seconds] Frame Number: 67 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap:ssl] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x385c [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 232 Checksum: 0x6329 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x4 (4) Length: 224 Authenticator: E1D8149F5F84CF6AB2EF07BC7AB683F2 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE AVP: l=110 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 108 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x0): Secure Socket Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 97 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 93 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jun 3, 2008 00:35:22.000000000 random_bytes: 38DD0828D867BEEFB4B298B72518C35459979BC7ED92A0D7... Session ID Length: 0 Cipher Suites Length: 54 Cipher Suites (27 suites) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (0x0061) Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA (0x0065) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) AVP: l=18 t=Message-Authenticator(80): 4A1E0B1F9718533C8A225B0FC8EBB617 Message-Authenticator: 4A1E0B1F9718533C8A225B0FC8EBB617 No. Time Source Destination Protocol Info 68 89.725405 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=4, l=1090) Frame 68 (1132 bytes on wire, 1132 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.625283000 [Time delta from previous captured frame: 0.044327000 seconds] [Time delta from previous displayed frame: 0.044327000 seconds] [Time since reference or first frame: 89.725405000 seconds] Frame Number: 68 Frame Length: 1132 bytes Capture Length: 1132 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1118 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb3fe [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 1098 Checksum: 0x86ec [incorrect, should be 0x7116 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x4 (4) Length: 1090 Authenticator: BFFB901870A6B7784BF8FC427088FD1F Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1024 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0xC0): Length More Length: 2669 AVP: l=18 t=Message-Authenticator(80): F7F26F81A3C0666CA9725E9E0C46907C Message-Authenticator: F7F26F81A3C0666CA9725E9E0C46907C AVP: l=18 t=State(24): 6B1410EF6A101D4FB7BBF03DE9D33AFE State: 6B1410EF6A101D4FB7BBF03DE9D33AFE back at one.... ________________________________ 雅虎邮箱，您的终生邮箱！ ________________________________ 雅虎邮箱，您的终生邮箱！ ___________________________________________________________ 雅虎邮箱，您的终生邮箱！ http://cn.mail.yahoo.com/

1 0

RE： TLS/wired fail
by 娟严 03 Jun '08

03 Jun '08

Hi,All! I 'd like to add some infos about this issue. TLS/wired is failed,but MD5/wired is successful. It's Ok when I use AP instead of switch authenticating eap/tls and eap/ttls with the same freeradius. Is it the problem of switch or the problem of radius? I think it's the problem of radius server,because md5 can authenticate successful, that means 802.1X works properly on switch. So how to configure freeradius as wired authentication? I don't use sql, I just add some items at the end of the users file,just like this: switch_client Cleartext-Password :="whatever" #################################### Hi,All! My freeradius version is v2.0.2,and I use cisco 2950 switch as Authenticator; the packet sent by server miss the EAP-TLS Fragments(server sent a packet which miss the server hello and ciper suilt messages after received a client hello packet),I don't kown what the prolbem.Can anybody help me? Here are the packets,the ip of radius server is:192.168.0.197,the ip of switch is:192.168.0.123. No. Time Source Destination Protocol Info 63 89.556162 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=3, l=116) Frame 63 (158 bytes on wire, 158 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.456040000 [Time delta from previous captured frame: 1.228814000 seconds] [Time delta from previous displayed frame: 89.556162000 seconds] [Time since reference or first frame: 89.556162000 seconds] Frame Number: 63 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x38c9 [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 124 Checksum: 0x12c3 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x3 (3) Length: 116 Authenticator: FE6787CBF64C4301CBAD5355610B9634 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=20 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 18 Type: Identity [RFC3748] (1) Identity (13 bytes): switch_client AVP: l=18 t=Message-Authenticator(80): 1C066799CF105346E40019AA2E291D22 Message-Authenticator: 1C066799CF105346E40019AA2E291D22 No. Time Source Destination Protocol Info 66 89.572574 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=3, l=64) Frame 66 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.472452000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.016412000 seconds] [Time since reference or first frame: 89.572574000 seconds] Frame Number: 66 Frame Length: 106 bytes Capture Length: 106 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 92 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb800 [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 72 Checksum: 0x82ea [incorrect, should be 0xa1e2 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x3 (3) Length: 64 Authenticator: D2EF3D5B79C3B1A4742E4A8C5FB00BD0 Attribute Value Pairs AVP: l=8 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 6 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x20): Start AVP: l=18 t=Message-Authenticator(80): A58A6FE1C598F8E9A979BABECD78BF65 Message-Authenticator: A58A6FE1C598F8E9A979BABECD78BF65 AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE No. Time Source Destination Protocol Info 67 89.681078 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=4, l=224) Frame 67 (266 bytes on wire, 266 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.580956000 [Time delta from previous captured frame: 0.108504000 seconds] [Time delta from previous displayed frame: 0.108504000 seconds] [Time since reference or first frame: 89.681078000 seconds] Frame Number: 67 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap:ssl] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x385c [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 232 Checksum: 0x6329 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x4 (4) Length: 224 Authenticator: E1D8149F5F84CF6AB2EF07BC7AB683F2 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE AVP: l=110 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 108 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x0): Secure Socket Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 97 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 93 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jun 3, 2008 00:35:22.000000000 random_bytes: 38DD0828D867BEEFB4B298B72518C35459979BC7ED92A0D7... Session ID Length: 0 Cipher Suites Length: 54 Cipher Suites (27 suites) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (0x0061) Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA (0x0065) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) AVP: l=18 t=Message-Authenticator(80): 4A1E0B1F9718533C8A225B0FC8EBB617 Message-Authenticator: 4A1E0B1F9718533C8A225B0FC8EBB617 No. Time Source Destination Protocol Info 68 89.725405 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=4, l=1090) Frame 68 (1132 bytes on wire, 1132 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.625283000 [Time delta from previous captured frame: 0.044327000 seconds] [Time delta from previous displayed frame: 0.044327000 seconds] [Time since reference or first frame: 89.725405000 seconds] Frame Number: 68 Frame Length: 1132 bytes Capture Length: 1132 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1118 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb3fe [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 1098 Checksum: 0x86ec [incorrect, should be 0x7116 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x4 (4) Length: 1090 Authenticator: BFFB901870A6B7784BF8FC427088FD1F Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1024 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0xC0): Length More Length: 2669 AVP: l=18 t=Message-Authenticator(80): F7F26F81A3C0666CA9725E9E0C46907C Message-Authenticator: F7F26F81A3C0666CA9725E9E0C46907C AVP: l=18 t=State(24): 6B1410EF6A101D4FB7BBF03DE9D33AFE State: 6B1410EF6A101D4FB7BBF03DE9D33AFE back at one.... ________________________________ 雅虎邮箱，您的终生邮箱！ ___________________________________________________________ 雅虎邮箱，您的终生邮箱！ http://cn.mail.yahoo.com/

1 0

TLS/wired fail
by 娟严 03 Jun '08

03 Jun '08

Hi,All! My freeradius version is v2.0.2,and I use cisco 2950 switch as Authenticator; the packet sent by server miss the EAP-TLS Fragments(server sent a packet which miss the server hello and ciper suilt messages after received a client hello packet),I don't kown what the prolbem.Can anybody help me? Here are the packets,the ip of radius server is:192.168.0.197,the ip of switch is:192.168.0.123. No. Time Source Destination Protocol Info 63 89.556162 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=3, l=116) Frame 63 (158 bytes on wire, 158 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.456040000 [Time delta from previous captured frame: 1.228814000 seconds] [Time delta from previous displayed frame: 89.556162000 seconds] [Time since reference or first frame: 89.556162000 seconds] Frame Number: 63 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x38c9 [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 124 Checksum: 0x12c3 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x3 (3) Length: 116 Authenticator: FE6787CBF64C4301CBAD5355610B9634 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=20 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 18 Type: Identity [RFC3748] (1) Identity (13 bytes): switch_client AVP: l=18 t=Message-Authenticator(80): 1C066799CF105346E40019AA2E291D22 Message-Authenticator: 1C066799CF105346E40019AA2E291D22 No. Time Source Destination Protocol Info 66 89.572574 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=3, l=64) Frame 66 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.472452000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.016412000 seconds] [Time since reference or first frame: 89.572574000 seconds] Frame Number: 66 Frame Length: 106 bytes Capture Length: 106 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 92 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb800 [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 72 Checksum: 0x82ea [incorrect, should be 0xa1e2 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x3 (3) Length: 64 Authenticator: D2EF3D5B79C3B1A4742E4A8C5FB00BD0 Attribute Value Pairs AVP: l=8 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 6 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x20): Start AVP: l=18 t=Message-Authenticator(80): A58A6FE1C598F8E9A979BABECD78BF65 Message-Authenticator: A58A6FE1C598F8E9A979BABECD78BF65 AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE No. Time Source Destination Protocol Info 67 89.681078 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=4, l=224) Frame 67 (266 bytes on wire, 266 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.580956000 [Time delta from previous captured frame: 0.108504000 seconds] [Time delta from previous displayed frame: 0.108504000 seconds] [Time since reference or first frame: 89.681078000 seconds] Frame Number: 67 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap:ssl] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x385c [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 232 Checksum: 0x6329 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x4 (4) Length: 224 Authenticator: E1D8149F5F84CF6AB2EF07BC7AB683F2 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE AVP: l=110 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 108 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x0): Secure Socket Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 97 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 93 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jun 3, 2008 00:35:22.000000000 random_bytes: 38DD0828D867BEEFB4B298B72518C35459979BC7ED92A0D7... Session ID Length: 0 Cipher Suites Length: 54 Cipher Suites (27 suites) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (0x0061) Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA (0x0065) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) AVP: l=18 t=Message-Authenticator(80): 4A1E0B1F9718533C8A225B0FC8EBB617 Message-Authenticator: 4A1E0B1F9718533C8A225B0FC8EBB617 No. Time Source Destination Protocol Info 68 89.725405 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=4, l=1090) Frame 68 (1132 bytes on wire, 1132 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.625283000 [Time delta from previous captured frame: 0.044327000 seconds] [Time delta from previous displayed frame: 0.044327000 seconds] [Time since reference or first frame: 89.725405000 seconds] Frame Number: 68 Frame Length: 1132 bytes Capture Length: 1132 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1118 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb3fe [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 1098 Checksum: 0x86ec [incorrect, should be 0x7116 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x4 (4) Length: 1090 Authenticator: BFFB901870A6B7784BF8FC427088FD1F Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1024 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0xC0): Length More Length: 2669 AVP: l=18 t=Message-Authenticator(80): F7F26F81A3C0666CA9725E9E0C46907C Message-Authenticator: F7F26F81A3C0666CA9725E9E0C46907C AVP: l=18 t=State(24): 6B1410EF6A101D4FB7BBF03DE9D33AFE State: 6B1410EF6A101D4FB7BBF03DE9D33AFE back at one.... ___________________________________________________________ 雅虎邮箱，您的终生邮箱！ http://cn.mail.yahoo.com/

1 0